Spring Boot and MVC: IoC, Beans, Validation, HTTP

What is Inversion of Control (IoC)?

A principle where Spring controls object creation, wiring, and lifecycle instead of application code.

What is an IoC container?

The Spring component that creates, configures, wires, and manages beans.

What is Dependency Injection (DI)?

Supplying an object with dependencies from outside rather than constructing them inside the object.

How do IoC and DI relate?

IoC is the principle; DI is a common way Spring implements it.

What are the three DI types?

Constructor injection, setter injection, and field injection.

How do constructor and setter injection differ?

Constructor injection sets required dependencies at creation; setter injection supplies them afterward.

Why is field injection less recommended?

It hides dependencies and complicates unit testing and immutability.

Which DI type is preferred for required dependencies?

Constructor injection: explicit dependencies, easy testing, and final fields.

What does @Autowired do?

Requests that Spring resolve and inject a matching bean.

What is @Qualifier used for?

Selecting a specific bean when multiple candidates have the same type.

What does @Primary do?

Marks the preferred bean when several candidates match.

What is a Spring bean?

An object created, configured, and managed by the Spring IoC container.

What is component scanning?

Spring discovers annotated components in selected packages and registers them as beans.

What does @ComponentScan control?

The packages Spring scans to find annotated classes and register beans.

Which annotations mark Spring components?

@Component, @Service, @Repository, and @Controller; @RestController is also a component.

What are the basic bean lifecycle stages?

Instantiate → inject dependencies → initialize → use → destroy.

What does @PostConstruct do?

Runs an initialization method after dependencies are injected.

What does @PreDestroy do?

Runs cleanup before a managed bean is destroyed; not automatically for prototype beans.

What is singleton bean scope?

One bean instance per bean definition within one Spring container; the default.

What is prototype bean scope?

A new instance whenever that bean is requested from the container.

What are the web bean scopes?

Request, session, application, and WebSocket scopes.

Request scope vs session scope?

Request creates one bean per HTTP request; session uses one per HTTP session.

What does @Bean do?

Registers the return value of a configuration method as a Spring-managed bean.

What does @Configuration do?

Marks a class containing bean definitions and application configuration.

What is Spring Initializr?

A tool that generates Spring Boot projects with build files, dependencies, and an entry point.

Which build tools can Spring Initializr use?

Maven or Gradle.

What is a Spring Boot starter?

A curated dependency bundle for a feature such as web, JPA, or security.

What does @SpringBootApplication combine?

@SpringBootConfiguration, @EnableAutoConfiguration, and @ComponentScan.

What is Spring Boot Actuator?

A module exposing operational endpoints for health, metrics, and management.

What does /actuator/health show?

Application health status, commonly UP or DOWN.

What do /actuator/info and /actuator/metrics do?

Info shows configured app information; metrics exposes measurements.

Why secure Actuator endpoints?

Some endpoints reveal sensitive application and operational details.

What do HTTP status categories 1xx-5xx mean?

1xx information; 2xx success; 3xx redirection; 4xx client error; 5xx server error.

What do 200, 201, and 204 mean?

200 OK; 201 Created; 204 No Content.

What do 400, 401, 403, and 404 mean?

400 Bad Request; 401 Unauthorized; 403 Forbidden; 404 Not Found.

What does 500 mean?

Internal Server Error.

What do HTTP 301 and 302 mean?

301 Moved Permanently; 302 Found (temporary redirection).

How do you set a status code in a controller?

Use ResponseEntity.status(HttpStatus.CREATED).body(value), or @ResponseStatus.

What does @Valid do on an endpoint parameter?

Triggers Bean Validation on the supplied object, such as @Valid @RequestBody UserDto dto.

What happens when request-body validation fails?

Spring MVC typically returns 400 Bad Request for invalid @Valid request bodies.

What is @NotNull vs @NotEmpty vs @NotBlank?

@NotNull rejects null; @NotEmpty rejects null/empty; @NotBlank also rejects whitespace-only text.

What does @Size do?

Sets minimum and maximum length or size for supported values.

What do @Email, @Min, @Max, and @Pattern do?

Validate email format, numeric bounds, and regex pattern, respectively.

What is @RestController?

A controller whose handler return values are written directly to HTTP response bodies, often as JSON.

How does @RestController differ from @Controller?

@RestController includes @ResponseBody; @Controller can return view names.

What is @RequestMapping?

Defines a URL mapping and can constrain HTTP methods and other request conditions.

What are the five specialized HTTP mapping annotations?

@GetMapping, @PostMapping, @PutMapping, @PatchMapping, @DeleteMapping.

What are GET, POST, PUT, PATCH, DELETE commonly used for?

Retrieve, create, replace, partially update, and delete resources.

What do @PathVariable, @RequestParam, @RequestBody do?

Bind URL path parts, query parameters, and request body data to method arguments.

What is Spring MVC?

Spring's web framework for HTTP request handling using Model-View-Controller and DispatcherServlet.

What does DispatcherServlet do in Spring MVC?

Acts as the front controller, dispatching HTTP requests to handlers.

What is ORM?

Object-Relational Mapping links Java objects and fields to relational tables and columns.

What is Hibernate?

A Java ORM framework that maps entities and performs persistence operations.

What are Hibernate benefits?

Less JDBC boilerplate, object mapping, caching, and database dialect support.

How do JPA and Hibernate relate?

JPA is a persistence specification; Hibernate is an implementation of it.

What does @Entity do?

Marks a class as a persistent entity mapped to a database table.

What does @Id do?

Identifies an entity's primary-key field.

What does @GeneratedValue do?

Configures how an entity primary-key value is generated.

How do Spring Data and Hibernate differ?

Spring Data offers repository abstractions; Hibernate performs ORM and persistence.

What is JpaRepository vs CrudRepository?

CrudRepository offers core CRUD; JpaRepository adds JPA-focused methods and paging/sorting inheritance.

What is a derived query method in Spring Data JPA?

A repository method such as findByEmail() whose name defines a query.

What is JPQL?

JPA-standard query language that queries entities and their properties.

What is HQL?

Hibernate Query Language: entity-based queries with Hibernate-specific features.

What is native SQL?

Direct SQL targeting physical database tables and columns.

What is the Criteria API?

A Java API for constructing type-aware, dynamic entity queries programmatically.

What does @Transactional do?

Defines a Spring-managed transaction boundary for commit and rollback.

What does ACID stand for?

Atomicity, Consistency, Isolation, Durability: key transaction properties.

What is the default @Transactional propagation?

REQUIRED: join an existing transaction or create one if none exists.

How does REQUIRES_NEW differ from REQUIRED?

REQUIRES_NEW suspends an existing transaction and starts an independent one.

What does NESTED propagation do?

Creates a nested transaction using a savepoint when supported.

What do SUPPORTS and MANDATORY mean?

SUPPORTS uses a transaction if present; MANDATORY fails if none exists.

What do NOT_SUPPORTED and NEVER mean?

NOT_SUPPORTED runs without a transaction; NEVER fails if one exists.

When does @Transactional roll back by default?

Normally on unchecked RuntimeException and Error, not ordinary checked exceptions.

What is transaction isolation?

Rules governing how concurrent transactions see each other's database changes.

What is Spring Security?

A framework for authentication and authorization of Spring applications.

What is authentication vs authorization?

Authentication verifies identity; authorization determines allowed actions.

What is SecurityConfig?

A conventional configuration class defining security beans and access rules, such as SecurityFilterChain.

What is CORS?

Cross-Origin Resource Sharing: browser rules for accessing responses from another origin.

What is UserDetailsService?

A Spring Security interface that loads user information through loadUserByUsername().

What is UserDetailsManager?

Extends UserDetailsService with operations to create, update, and delete users.

What is RBAC?

Role-Based Access Control: permissions granted through roles such as USER or ADMIN.

How can Spring Security restrict an endpoint to admins?

Use an authorization rule such as hasRole("ADMIN") for the endpoint.

What is @RestControllerAdvice?

Global advice for REST controllers, including centralized exception handling and response bodies.

How does @ControllerAdvice differ from @RestControllerAdvice?

@RestControllerAdvice includes @ResponseBody, suitable for REST error responses.

What is @ExceptionHandler?

Marks a method to handle specified exception types thrown during request processing.

How do @RestControllerAdvice and @ExceptionHandler work together?

The advice class applies globally; @ExceptionHandler chooses exceptions and returns a suitable HTTP response.

What status might a missing resource exception return?

404 Not Found, often set with ResponseEntity or @ResponseStatus in an exception handler.